Authentication
Public documentation. Credential-bound API access. Separate responsibilities.
Credentials belong on the server
The operation reference renders the security schemes from its contract. Partner Data uses a location-bound client ID and API key. Partner Ecom uses short-lived, operation-bound service bearer credentials. Customer Connections distinguishes partner credentials from customer-subject credentials.
Use the credential and exact base URL supplied through approved onboarding. Do not reuse a staff browser session or an Admin token as a partner credential. The documentation site neither issues nor accepts API credentials.
Admission is not business authority
Gateway admission, quotas, and analytics are separate from domain authorization. The product service resolves the permitted assignment, location, operation, revision, and, where required, active customer grant. An accepted gateway credential cannot expand those boundaries.
Fresh credentials for retries
Where the contract uses single-use service credentials, each attempt needs a fresh credential. A business retry can retain its scoped idempotency key and canonical payload, but must not replay an expired or previously consumed authentication token. Follow the selected product’s contract; credential lifetimes are not interchangeable.